Senior Security Operations / Detection Engineer

present of AI; San Francisco (CA); Presencial; USD 180.000 - 240.000; Jornada completa

Descripción de la vacante

LiteLLM in San Francisco is hiring a Senior Security Operations / Detection Engineer. The role is hands-on, focusing on collecting logs, writing and tuning detections, documenting response procedures, and leading incidents when facts are unclear.

A strong candidate has built detection and response from the ground up, knows GitHub, Okta and cloud audit logs well, and understands token abuse and sign-in systems.

Formación

• Experience building detection and response functions from the ground up.
• Strong knowledge of GitHub, Okta and cloud audit logs.
• Understanding token abuse and sign-in systems.

Responsabilidades

• Collect logs, write and tune detections, and document how to respond to each alert.
• Lead incidents when facts are unclear and coordinate response efforts.
• Develop and maintain detections as code and ensure reliable alerts.

Conocimientos

GitHub

Okta

Cloud audit logs

Threat detection

Incident response

Detections as code

Herramientas

Splunk

Descripción del empleo

Senior Security Operations / Detection Engineer

Engineering · San Francisco · FullTime · Senior level

The role is a hands-on, solo security operations position. It covers collecting logs, writing and tuning detections, documenting how to respond to each alert, and leading incidents when facts are still unclear. A strong candidate has built a detection and response function from the ground up, knows GitHub, Okta and cloud audit logs well, understands how attackers abuse tokens and sign-in systems, and writes clear updates under pressure.

How it fits the AI era

LiteLLM sits between developers and AI model providers, so the systems being protected hold API keys, budgets and access rules for AI traffic. AI tools can help draft detections, summarize alerts and speed up investigation scripts, but deciding what matters, when to contain a threat and how to tell engineers and customers about bad news stays with a person.

How it builds AI experience

This role would give direct exposure to defending an AI gateway, where stolen keys, misused access and unexpected spend are real risks. Someone could build relevant experience by studying how a gateway handles keys and permissions, then writing detections for odd access patterns and using AI assistants to speed up log analysis and runbook drafting.

Worth showing

• Detections managed as code
• SIEM tuning, ideally Splunk
• Incident lead examples
• OAuth and token abuse knowledge

This is our own read, written from the employer's posting and the company's Spotlight. The employer's posting is the source of truth for the role.

About LiteLLM

An open-source gateway that, the company says, lets developers call more than 100 AI model providers through one OpenAI-style interface, with spend tracking and access controls.